Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2023-47090: NATS nats-server: Unauthenticated Access to Some Users
CVE-2023-47090 · published 3 years ago
Summary
Older versions of NATS server have a security flaw that allows some users to access the system without a password. This is a concern for organizations that use NATS server for secure communication. Update to the latest version of NATS server to fix this issue.
What to do
- Update github.com nats-io to version 2.9.23.
- Update github.com nats-io to version 2.10.2.
- Update debian nats-server to version 2.10.3-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | nats-io |
>= 2.2.0, < 2.9.23 >= 2.10.0, < 2.10.2 Fix: upgrade to 2.9.23
|
| – | linuxfoundation | nats-server |
>= 2.2.0, < 2.9.23 >= 2.10.0, < 2.10.2 cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:* |
| Debian:12 | debian | nats-server | All versions |
| Debian:13 | debian | nats-server |
< 2.10.3-1 Fix: upgrade to 2.10.3-1
|
Original advisory text
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the i...
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.
References
- https://github.com/nats-io/nats-server/pull/4605
- https://github.com/nats-io/nats-server/commit/fa5b7afcb64e7e887e49afdd032358802b...
- https://advisories.nats.io/CVE/secnote-2023-01.txt
- https://github.com/nats-io/nats-server/discussions/4535
- https://github.com/nats-io/nats-server/releases/tag/v2.10.2
- https://github.com/nats-io/nats-server/releases/tag/v2.9.23
- https://github.com/advisories/GHSA-fr2g-9hjm-wr23
- https://www.openwall.com/lists/oss-security/2023/10/13/2 URL
- https://github.com/nats-io/nats-server/security/advisories/GHSA-fr2g-9hjm-wr23 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-47090 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47090... Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2023-47090 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/10/30/1 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-305Authentication Bypass by Primary Weakness
CWE-863Incorrect Authorization
Timeline
Published30 Oct 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-fr2g-9hjm-wr23 · GHSA
CVE-2023-47090 · NVD
CVE-2023-47090 · OSV
DEBIAN-CVE-2023-47090 · OSV
Track software like this
Free during beta